diff options
| author | Alexandr Miloslavskiy <alexandr.miloslavskiy@syntevo.com> | 2019-11-21 20:26:22 +0100 |
|---|---|---|
| committer | Benjamin Otte <otte@redhat.com> | 2019-11-23 18:15:19 +0100 |
| commit | fd1630e049e1b9d670d1b16ab9801628f638dd86 (patch) | |
| tree | 6ac0bf185ac4c787d8614bfb19b0f759bd083b0b /gtk/gtkcssshorthandpropertyimpl.c | |
| parent | e3c3cbbbcb4706203fe33b2eb471123242a7b89f (diff) | |
| download | gtk+-fd1630e049e1b9d670d1b16ab9801628f638dd86.tar.gz | |
Fix crash in parse_border()
The bug was introduced in commit:
9b7640b8 by Benjamin Otte, 2012-03-26 17:24:02
styleproperty: Make _gtk_style_property_parse_value() return a CssValue
In that commit, `values` changed from `GValue*` to `GtkCssValue**`,
but one `!G_IS_VALUE (&values[8])` was left untouched. As a result,
if `border` shorthand contains anything after color, it might crash,
depending on memory layout.
New test included.
Fixes: #751
Diffstat (limited to 'gtk/gtkcssshorthandpropertyimpl.c')
| -rw-r--r-- | gtk/gtkcssshorthandpropertyimpl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/gtk/gtkcssshorthandpropertyimpl.c b/gtk/gtkcssshorthandpropertyimpl.c index 0ada0f6a3e..290c6afdd0 100644 --- a/gtk/gtkcssshorthandpropertyimpl.c +++ b/gtk/gtkcssshorthandpropertyimpl.c @@ -387,7 +387,7 @@ parse_border (GtkCssShorthandProperty *shorthand, values[6] = _gtk_css_value_ref (values[4]); values[7] = _gtk_css_value_ref (values[4]); } - else if (!G_IS_VALUE (&values[8])) + else if (values[8] == NULL) { values[8] = _gtk_css_color_value_parse (parser); if (values[8] == NULL) |